update

microweber · Jun 3, 2022 · 16db81c · 16db81c
1 parent 02bc85e
commit 16db81c
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/userfiles/modules/files/admin_backend.php b/userfiles/modules/files/admin_backend.php
@@ -342,7 +342,10 @@
 
     </style>
 
-    <script>mw.require("<?php print $config['url_to_module']; ?>/files_admin.js"); </script>
+    <script>
+        MEDIA_UPLOADS_URL = '<?php echo media_uploads_url(); ?>';
+        mw.require("<?php print $config['url_to_module']; ?>/files_admin.js");
+    </script>
 
     <script type="text/javascript">
         gchecked = function () {

diff --git a/userfiles/modules/files/files_admin.js b/userfiles/modules/files/files_admin.js
@@ -76,6 +76,12 @@ if (self === parent) {
 
         pval = filterXSS(pval);
 
+        var checkUrlIsCorrect = pval.indexOf(MEDIA_UPLOADS_URL);
+        if (checkUrlIsCorrect !== 0) {
+            mw.notification.error('Wrong media file.');
+            return false;
+        }
+
         if (pval.valueOf()) {
             var type = pval.valueOf().split(".").pop();
             type = type.toLowerCase();